Introduction
This policy describes how Rainbow Railroad collects, uses, discloses, and retains your personal information. “Personal information” means information about an identifiable individual.
By using this website, supporting us as a volunteer or donor, or by seeking and receiving our services as a client, you consent to us using your personal information as described in this policy.
You can withdraw your consent to the collection, use or disclosure of your personal information by contacting our Privacy Officer (see “Inquiries” below). However, in some cases withdrawing consent will mean that Rainbow Railroad can no longer provide you with certain services or perform certain tasks where the information is required to do so.
This policy applies globally, but we have included additional information below for residents of the European Economic Area, the United Kingdom, Switzerland and California.
Why and how we collect, use and disclose your personal information
What we do with your information depends on whether you are a Rainbow Railroad supporter, client, or employee.
Supporters
First, if you are a supporter, such as a volunteer, donor, or event host or attendee, thank you! We are sincerely grateful for your support. As a supporter, we collect, use and disclose your information to facilitate and foster your support. This includes to:
- Communicate with you and keep you updated on our mission;
- Manage our relationship with you;
- Recruit, train, manage and coordinate our team of supporters;
- Plan, support and invite you to events;
- Manage our day-to-day business operations;
- Process payments (such as donations or ticket sales) and issue tax receipts; and
- Comply with legal requirements.
The types of information we will collect about you will depend on your exact role as a supporter. Generally, we will only collect information you provide us, such as contact, address and payment information.
For volunteers, we will use your personal information (such as your area of expertise, or past support you have provided us) to manage the volunteer relationship, including the recruitment and post-volunteer phases. We may also conduct background checks on volunteers that will have access to sensitive information.
Clients and people seeking help
We refer to the LGBTQI+ people we advise and support in their efforts to get to safety through our case work as “clients.” You are a “person seeking help” if you have submitted a request for help on our Request Help page, but we have not confirmed that you are a client. Remember: you are not a client unless we tell you that you are a client.
Our case work is conducted by case workers who abide by the Code of Ethical Conduct for Case Committee Members. We treat all information that is shared with us a confidential. All our volunteers that assist with case work sign confidentiality and non-disclosure agreements.
As a client or person seeking help, we may collect, use and disclose your information to:
- Communicate with you;
- Verify your identity and your request for help;
- Assess and prioritize your case;
- Help you to develop and use your plan, including finding which resources, contacts and options may be available to you;
- Connect you with our resources, supports and contacts, including when you reach your destination country;
- Monitor your progress in seeking safety; and
- Comply with legal requirements.
We generally encourage you to provide us with as much relevant information as possible about your situation. When you first contact us, we ask you to tell us: your name, email and date of birth; what country and region you are in; what forms of violence and/or threats you’ve experienced related to your sexual orientation, gender identity and/or gender expression; and what immediate risk you are in. We also recommend you provide supporting documentation.
We understand it can be very difficult for people who are at risk to provide this information to others, but this information is needed so that we can verify and assess your case.
Cases are sometimes referred to us by LGBTQI+ organizations that we trust and have a close relationship with. In these situations, the LGBTQI+ organization can confirm that an individual is a member of their community and in legitimate need of our support. We may also use local LGBTQI+ organizations to help authenticate or assess cases and to help clients. If necessary, may try to verify you through people who we have already helped or worked with.
Once we verify your case and confirm that you are a client, we will try to work with you to develop a solution to make your life safer. We may request many different types of information from you because there are many different types of solutions we consider. However, we will only request your information for the list of purposes above.
For more information on what we do with your personal information and our purposes for collecting, using and disclosing your personal information, see our Request Help page. Note that we may contact you before, during and after you execute your plan in order to support you and seek feedback on that support.
Employees
For employees and potential employees, we collect, use and disclose your personal information to:
- Recruit and make hiring decisions, such as ensuring you meet any job requirements;
- Manage our employment relationship with you, including training, payment and benefits, and the end of employment; and
- Comply with legal requirements.
Because we are committed to diversity in our workplace, we may also collect demographic information from you about the groups and communities with which you identify. We may rely on background and reference checks when making hiring decisions.
General Privacy Practices
Handling personal information. We limit the collection, use and disclosure of personal information to what is appropriate for our purposes described in the section above. We will never sell your information. Once your information is no longer needed, we will destroy, erase or anonymize your information.
Protecting personal information. We apply physical and electronic protections to your personal information. These protections include passwords, limiting access to information to a “need-to-know” basis, and physical security in our building. As a general practice, we apply more protections to personal information that is more sensitive or could lead to more harm to someone.
Storing personal information internationally. One of our offices is based in New York, and some of our service providers are based outside Canada. This means your information may be stored outside of Canada and accessible to law enforcement authorities in accordance with the laws of that jurisdiction. However, all our offices are required to comply with this policy, and we require our service providers to provide the same level of protection to your personal information as we do.
Limiting disclosure without consent. There are some cases where we may be required or authorized by law to share your information without further notice to you. For example, we will comply with court orders that legally require us to provide information (although we will notify you of these orders unless we are legally not allowed to contact you). We will disclose information to enforce a debt or defend Rainbow Railroad in legal proceedings. We may also disclose your information when we believe you are in imminent harm, or if we believe illegal activity has occurred. In each case, we will not disclose any more personal information than is required to meet the request or need.
Cookies
We use cookies on this website. Cookies are essentially small packages of data stored on your internet browser that tell us about your browsing behaviour. We use that information to monitor usage of our website and improve it. We may also use this information to improve our marketing.
You can manage and delete the cookies in your browser’s settings. Some browsers include an ability that allows you to block cookies entirely, although this can affect some features on our website.
Google Analytics
We use Google Analytics to better understand your use of our website. Google Analytics collects information on user behaviour on our website, which includes how many times a user visits our website, what pages they visit, and where they were referred from. Google uses the data collected through cookies to track and examine the use of the website, to prepare reports on its activities, and share them with other Google services. Advertising identifiers for mobile devices (such as Android and iOS Advertising Identifiers) are also collected. Google may use the data collected on the websites to contextualize and personalize the ads of its own advertising network.
Google will not associate your IP address with any other data held by Google. To learn more about Google Analytics, click here. You can deactivate the Google Analytics function with a browser add-on, which you can download here. To do this you must install that browser add-on. This will prevent the analysis information from being sent to Google.
Accessing and Correcting Your Information
When requested in writing, we will inform you of the existence, use, and disclosure of your information that we maintain. We may not be able to provide you with all the information you request, depending on the circumstances, and there may be a charge for copies of your personal information. To access your personal information, submit a written a request that identifies yourself, the information you want to review and how we can contact you (see ‘Inquiries’ below).
We will make reasonable efforts to keep your information accurate and up-to-date. If a change or correction is required, let us know right away. We’ll make any appropriate updates needed. You can review your personal information by looking at the correspondence we send to you, or by requesting access to your personal information, as described below.
Unsubscribing and Withdrawing Consent
If you would like to unsubscribe from Rainbow Railroad communications, click here.
You can withdraw your consent to the collection, use or disclosure of your information at any time. However, in some cases withdrawing consent will mean that we can no longer provide you with certain services or perform certain tasks where the information is required to do so. You can withdraw your consent by contacting the Privacy Officer and, subject to any legal constraints, we will comply with your request. See below for how to contact our Privacy Officer.
Additional information for European residents
Basis of Lawful Processing
European data protection laws require us to be specific about our reasons or grounds for using your personal information. We may process the personal information of individuals located in the EU, Switzerland or UK on these grounds:
- Consent. When you have provided your consent to our collection of your information;
- Service performance. When you have asked us to perform a service, such as process a donation or review a request for help;
- Legitimate interests. When we have a legitimate business or organizational reason for using your information, and your interests and your fundamental rights do not override those interests;
- Legal obligation. When we need to comply with a legal or regulatory obligation; and/or
- Vital interests. When there’s an emergency and we need to protect your safety.
We may process your personal information on more than one ground depending on the reason or grounds for using your personal information. Please contact us if you need details about the specific grounds we are relying on to process your personal information.
Data subject rights
If you are a European, in addition to the access and correction rights outlined above, you may be entitled, subject to certain conditions, to exercise some or all of the following additional rights:
- Deletion. The right to request that we delete your information.
- Restrict processing. The right to request that we limit or cease the processing of your information.
- Portability. The right to request that we transfer your information that we have collected to another organization or directly to you.
In order to exercise these rights, contact our Privacy Officer using the contact information outlined below.
Additional information for California residents
If you are a California resident, you can make certain requests regarding your personal information. We will fulfill each of these requests to the extent required by law.
- You can ask us what personal information we have about you, including a list of categories of your personal information that we have sold and a list of categories of your personal information that we have shared with another company for a business purpose (however, we do not sell or share your information with others for business purposes).
- You can ask us to delete your personal information.
In order to exercise these rights, contact our Privacy Officer using the contact information outlined below.
Inquiries
Please contact Rainbow Railroad’s Privacy Officer in writing if:
- You have any questions or concerns regarding our collection, use and sharing of your personal information;
- You would like to correct your personal information provided to Rainbow Railroad; or
- You would like to request access to your personal information.
Our Privacy Officer can be reached at: ■ privacy@rainbowrailroad.org
Changes to this Privacy Policy
We may occasionally amend this policy. The most current version of this Privacy Policy will be available on our website.
